Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by tricking an authenticated user into attempting to connect to a malicious SQL server via OLEDB, which could result in the server receiving a malicious networking packet. This could allow the attacker to execute code remotely on the client.
Security updates
10.0.17763.5458 — https://support.microsoft.com/help/5034768
10.0.20348.2322 — https://support.microsoft.com/help/5034770
10.0.22000.2777 — https://support.microsoft.com/help/5034766
10.0.19044.4046 — https://support.microsoft.com/help/5034763
10.0.22621.3155 — https://support.microsoft.com/help/5034765
10.0.25398.709 — https://support.microsoft.com/help/5034769
10.0.10240.20469 — https://support.microsoft.com/help/5034774
10.0.14393.6709 — https://support.microsoft.com/help/5034767
6.0.6003.22511 — https://support.microsoft.com/help/5034795
6.0.6003.22511 — https://support.microsoft.com/help/5034833
6.1.7601.26961 — https://support.microsoft.com/help/5034831
6.1.7601.26961 — https://support.microsoft.com/help/5034809
6.2.9200.24710 — https://support.microsoft.com/help/5034830
6.3.9600.21813 — https://support.microsoft.com/help/5034819
Vulnerabilities 1
-
High 8.8
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2024-21350 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21350
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss